Bound flat-buffer vector deserialization

[AztecBot]

Summary

Flat-buffer vector deserialization accepted untrusted uint32_t lengths and resized vectors before any bound check. This change adds a shared 64 MiB deserialization budget so oversized byte and generic vector lengths fail before allocation.

Fix

• Add serialize::MAX_SERIALIZED_VECTOR_BYTES and validate vector sizes by element width before every vector resize.
• Add regression tests covering raw-buffer and stream reads for byte vectors and generic vectors.

Testing

• cmake --fresh --preset default
• cmake --build --preset default --target serialize-tests_tests -j$(nproc)
• ctest --preset default -R '^(Serialize\.|msgpack_tests\.)' --output-on-failure

Issues

• Closes AztecProtocol/barretenberg-claude#2415 — bound serialized vector lengths before deserialization allocation.

---

Created by claudebox · group: bb-audit-remediation